Designing Adversarially Resilient Classifiers using Resilient Feature Engineering
arXiv:1812.06626
Abstract
We provide a methodology, resilient feature engineering, for creating adversarially resilient classifiers. According to existing work, adversarial attacks identify weakly correlated or non-predictive features learned by the classifier during training and design the adversarial noise to utilize these features. Therefore, highly predictive features should be used first during classification in order to determine the set of possible output labels. Our methodology focuses the problem of designing resilient classifiers into a problem of designing resilient feature extractors for these highly predictive features. We provide two theorems, which support our methodology. The Serial Composition Resilience and Parallel Composition Resilience theorems show that the output of adversarially resilient feature extractors can be combined to create an equally resilient classifier. Based on our theoretical results, we outline the design of an adversarially resilient classifier.
References in corpus (11)
- Explaining and Harnessing Adversarial Examples
- Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
- Provable defenses against adversarial examples via the convex outer adversarial polytope
- Synthesizing Robust Adversarial Examples
- Robustness May Be at Odds with Accuracy
- Certifying Some Distributional Robustness with Principled Adversarial Training
- Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methods
- PixelDefend: Leveraging Generative Models to Understand and Defend against Adversarial Examples
- On the Robustness of the CVPR 2018 White-Box Adversarial Example Defenses
- Physical Adversarial Examples for Object Detectors
- The Limitations of Deep Learning in Adversarial Settings